Supercharge your infrastructure

Trendy UK estate agency Foxtons pushed the big red password reset button, as a precaution, after it appeared hackers lifted thousands of clients' usernames and passwords from its systems.

Miscreants claimed to have leaked online user names, email addresses and passwords of nearly 10,000 Foxtons’ customers, Estate Agent Today reports. The supposed logins to MyFoxtons web portal, some partially obscured, were uploaded to Pastebin.

The list was quickly pulled but the assumption has to be that copies were made before this happened. Anyone with access to the list, whose authenticity remains unconfirmed, may have been able to log into Foxtons' systems and access all sorts of sensitive information such as addresses, phone numbers and rent payment details. This wouldn't include credit card or bank details but it would still provide rich fodder for follow-up social engineering attacks.

In an advisory to customers on Tuesday, forwarded to El Reg by readers, Foxtons said it was investigating the purported hack. In the meantime it had reset user passwords as a precaution:

We have been able to download the list of usernames and passwords that were posted and are currently running checks to determine its veracity. Please be assured though that any sensitive information, including credit card information that you may have provided in relation to payments made through Foxtons is completely secure with our external payment providers.

Immediate action, however, has been taken to safeguard your account and an investigation will continue. Should your account be upon the list, you will be contacted directly by our Team.

Whilst this investigation is underway, we are unwilling to run the risk that any live MyFoxtons account is upon the list and have initiated a trigger to reset user passwords upon your next successful login. It is not necessary to do this straight away, just the next time you want to use the account.

We asked a Foxtons representative whether the company hashed or salted stored passwords, a basic security practice. The rep declined to comment on any aspects of the incident beyond saying that it may decide to issue a statement at some point.

Ross Parsell, director of cyber security at Thales UK, said that tighter regulation might be needed to stem the growing list of data breaches.

“The recent spate of high-profile data breaches, such as this alleged attack on Foxtons, are evidence that organisations are either not taking cyber security seriously or are bewildered by the problem. Regulation in this case is a necessity to alter corporate behaviour." ®

5 ways to prepare your advertising infrastructure for disaster